CVE-2010-1647

Vulnerability

A cross-site scripting (XSS) vulnerability exists in MediaWiki versions 1.15 before 1.15.4 and 1.16 before 1.16 beta 3. The flaw resides in the CSS sanitization logic, which fails to account for differences in how Internet Explorer parses CSS escape sequences. Specifically, MediaWiki treats certain escape sequences (e.g., \72 followed by a non-ASCII whitespace character like U+3000) as safe, while Internet Explorer decodes them into executable JavaScript via the expression() function [1][2].

Exploitation

An attacker can craft a CSS string containing specially crafted hexadecimal escape sequences that are interpreted differently by Internet Explorer compared to MediaWiki's filter. The attacker does not require authentication and can inject the malicious CSS through any input that accepts CSS, such as user-contributed styles or page content. The attack only affects users browsing the wiki with Internet Explorer (confirmed on IE 6 and 8) [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to information disclosure, session hijacking, or other client-side attacks, potentially compromising the victim's account or sensitive data [1].

Mitigation

Upgrade to MediaWiki 1.15.4 or 1.16 beta 3, released on May 28, 2010. The fix normalizes CSS escape sequences to a form that is consistently parsed by both compliant browsers and Internet Explorer, preventing the injection vector. No workaround is available for unpatched versions [1][2].